[Date Prev][Date Next] [Chronological] [Thread] [Top]

Re: TLS problems with openldap

To: openldap-software@openldap.org
Subject: Re: TLS problems with openldap
From: LÉVAI Dániel <leva@ecentrum.hu>
Date: Mon, 27 Oct 2008 17:13:09 +0100
Cc: Philip Guenther <guenther+ldapsoft@sendmail.com>
Content-disposition: inline
In-reply-to: <alpine.BSO.1.10.0810270816380.16505@vanye.sendmail.com>
References: <4905965B.4050902@ecentrum.hu> <alpine.BSO.1.10.0810270816380.16505@vanye.sendmail.com>
User-agent: KMail/1.9.9

On Monday 27 October 2008 16.36.41 Philip Guenther wrote:
> On Mon, 27 Oct 2008, LÉVAI Dániel wrote:
> ...
>
> > Slapd starts with these settings gladly, and with a client (eg.
> > ldapsearch) without requesting TLS connection, I can get to the
> > invalid credentials error (which is what I'm expecting now, this is
> > just testing.).
> > But with requesting TLS:
>
> ...
>
> > $ ldapsearch -d 1 -ZZWx '(objectclass=*)' \
> > 	-H ldap://fileserver.digiszfv:636
>
> There are two ways to use LDAP with TLS/SSL:
> 1) start the connection in cleartext and then use the StartTLS
> extended-op to initiate a TLS layer, or
> 2) negotiate a TLS/SSL layer immediately after connecting.
>
Alright, understood! Thanks!

> The former is requested using the "ldap://"; schema with the -Z option
> and is normally run on port 389.  The latter is requested using the
> "ldaps://" schema and is normally run on port 636.  These are
> distinct protocols: the client and server have to be talking the same
> one or it just won't work.
>
[...]
> So, don't mix them.  If you want to do the former, then drop the
> bogus ":636" from the URL:
> 	ldapsearch -d 1 -ZZWx '(objectclass=*)' \
> 	 	-H ldap://fileserver.digiszfv
So, now:
$ ldapsearch -d 1 -ZZWx '(objectclass=*)' -H ldap://fileserver.digiszfv
ldap_url_parse_ext(ldap://fileserver.digiszfv)
ldap_create
ldap_url_parse_ext(ldap://fileserver.digiszfv:389/??base)
ldap_extended_operation_s
ldap_extended_operation
ldap_send_initial_request
ldap_new_connection 1 1 0
ldap_int_open_connection
ldap_connect_to_host: TCP fileserver.digiszfv:389
ldap_new_socket: 3
ldap_prepare_socket: 3
ldap_connect_to_host: Trying 192.168.1.3:389
ldap_pvt_connect: fd: 3 tm: -1 async: 0
ldap_open_defconn: successful
ldap_send_server_request
ber_scanf fmt ({it) ber:
ber_scanf fmt ({) ber:
ber_flush2: 31 bytes to sd 3
ldap_result ld 0x6120b0 msgid 1
wait4msg ld 0x6120b0 msgid 1 (infinite timeout)
wait4msg continue ld 0x6120b0 msgid 1 all 1
** ld 0x6120b0 Connections:
* host: fileserver.digiszfv  port: 389  (default)
  refcnt: 2  status: Connected
  last used: Mon Oct 27 17:02:27 2008


** ld 0x6120b0 Outstanding Requests:
 * msgid 1,  origid 1, status InProgress
   outstanding referrals 0, parent count 0
  ld 0x6120b0 request count 1 (abandoned 0)
** ld 0x6120b0 Response Queue:
   Empty
  ld 0x6120b0 response count 0
ldap_chkResponseList ld 0x6120b0 msgid 1 all 1
ldap_chkResponseList returns ld 0x6120b0 NULL
ldap_int_select
read1msg: ld 0x6120b0 msgid 1 all 1
ber_get_next
ber_get_next: tag 0x30 len 12 contents:
read1msg: ld 0x6120b0 msgid 1 message type extended-result
ber_scanf fmt ({eAA) ber:
read1msg: ld 0x6120b0 0 new referrals
read1msg:  mark request completed, ld 0x6120b0 msgid 1
request done: ld 0x6120b0 msgid 1
res_errno: 0, res_error: <>, res_matched: <>
ldap_free_request (origid 1, msgid 1)
ldap_free_connection 0 1
ldap_free_connection: refcnt 1
ldap_parse_extended_result
ber_scanf fmt ({eAA) ber:
ldap_parse_result
ber_scanf fmt ({iAA) ber:
ber_scanf fmt (}) ber:
ldap_msgfree
Enter LDAP Password:
ldap_sasl_bind
ldap_send_initial_request
ldap_send_server_request
ber_scanf fmt ({it) ber:
ber_scanf fmt ({i) ber:
ber_flush2: 20 bytes to sd 3
ldap_result ld 0x6120b0 msgid 2
wait4msg ld 0x6120b0 msgid 2 (infinite timeout)
wait4msg continue ld 0x6120b0 msgid 2 all 1
** ld 0x6120b0 Connections:
* host: fileserver.digiszfv  port: 389  (default)
  refcnt: 2  status: Connected
  last used: Mon Oct 27 17:02:30 2008


** ld 0x6120b0 Outstanding Requests:
 * msgid 2,  origid 2, status InProgress
   outstanding referrals 0, parent count 0
  ld 0x6120b0 request count 1 (abandoned 0)
** ld 0x6120b0 Response Queue:
   Empty
  ld 0x6120b0 response count 0
ldap_chkResponseList ld 0x6120b0 msgid 2 all 1
ldap_chkResponseList returns ld 0x6120b0 NULL
ldap_int_select
read1msg: ld 0x6120b0 msgid 2 all 1
ber_get_next
ldap_free_connection 1 0
ldap_free_connection: actually freed
ldap_err2string
ldap_result: Can't contact LDAP server (-1)

# tail syslog
slapd[3779]: slap_listener_activate(8):
slapd[3779]: >>> slap_listener(ldap://fileserver.digiszfv:389/)
slapd[3779]: connection_get(15): got connid=35
slapd[3779]: connection_read(15): checking for input on id=35
slapd[3779]: conn=35 op=0 do_extended
slapd[3779]: send_ldap_extended: err=0 oid= len=0
slapd[3779]: send_ldap_response: msgid=1 tag=120 err=0
slapd[3779]: connection_get(15): got connid=35
slapd[3779]: connection_read(15): checking for input on id=35
slapd[3779]: connection_get(15): got connid=35
slapd[3779]: connection_read(15): checking for input on id=35
slapd[3779]: connection_get(15): got connid=35
slapd[3779]: connection_read(15): checking for input on id=35
slapd[3779]: connection_read(15): TLS accept failure error=-1 id=35, 
closing
slapd[3779]: connection_closing: readying conn=35 sd=15 for close
slapd[3779]: connection_close: conn=35 sd=15

>
> If you want to do the latter, then set the schema correctly, drop the
> -Z options, and drop the ":636" (because that's the default for
> ldaps): ldapsearch -d 1 -Wx '(objectclass=*)' \
> 	 	-H ldaps://fileserver.digiszfv

$ ldapsearch -d 1 -Wx '(objectclass=*)' -H ldaps://fileserver.digiszfv
ldap_url_parse_ext(ldaps://fileserver.digiszfv)
ldap_create
ldap_url_parse_ext(ldaps://fileserver.digiszfv:636/??base)
Enter LDAP Password:
ldap_sasl_bind
ldap_send_initial_request
ldap_new_connection 1 1 0
ldap_int_open_connection
ldap_connect_to_host: TCP fileserver.digiszfv:636
ldap_new_socket: 3
ldap_prepare_socket: 3
ldap_connect_to_host: Trying 192.168.1.3:636
ldap_pvt_connect: fd: 3 tm: -1 async: 0
ldap_open_defconn: successful
ldap_send_server_request
ber_scanf fmt ({it) ber:
ber_scanf fmt ({i) ber:
ber_flush2: 20 bytes to sd 3
ldap_result ld 0x6120b0 msgid 1
wait4msg ld 0x6120b0 msgid 1 (infinite timeout)
wait4msg continue ld 0x6120b0 msgid 1 all 1
** ld 0x6120b0 Connections:
* host: fileserver.digiszfv  port: 636  (default)
  refcnt: 2  status: Connected
  last used: Mon Oct 27 17:05:59 2008


** ld 0x6120b0 Outstanding Requests:
 * msgid 1,  origid 1, status InProgress
   outstanding referrals 0, parent count 0
  ld 0x6120b0 request count 1 (abandoned 0)
** ld 0x6120b0 Response Queue:
   Empty
  ld 0x6120b0 response count 0
ldap_chkResponseList ld 0x6120b0 msgid 1 all 1
ldap_chkResponseList returns ld 0x6120b0 NULL
ldap_int_select
read1msg: ld 0x6120b0 msgid 1 all 1
ber_get_next
ldap_free_connection 1 0
ldap_free_connection: actually freed
ldap_err2string
ldap_result: Can't contact LDAP server (-1)

# tail syslog
slapd[3779]: slap_listener_activate(9):
slapd[3779]: >>> slap_listener(ldaps://fileserver.digiszfv:636/)
slapd[3779]: connection_get(15): got connid=36
slapd[3779]: connection_read(15): checking for input on id=36
slapd[3779]: connection_get(15): got connid=36
slapd[3779]: connection_read(15): checking for input on id=36
slapd[3779]: connection_get(15): got connid=36
slapd[3779]: connection_read(15): checking for input on id=36
slapd[3779]: connection_read(15): TLS accept failure error=-1 id=36, 
closing
slapd[3779]: connection_closing: readying conn=36 sd=15 for close
slapd[3779]: connection_close: conn=36 sd=15

> Philip Guenther

With both ldapsearch(1) commands, I've been asked for my password, and I 
typed something bogus intentionally, in the hope of getting the invalid 
credentials message, but unfortunatelly, I didn't get it.
The only time ldapsearch(1) is working as "expected", is when I'm 
running it without the -ZZ option and with ldap:// (not ldaps://):

$ ldapsearch -d 1 -Wx '(objectclass=*)' -H ldap://fileserver.digiszfv
[...]
Enter LDAP Password:
[...]
ldap_bind: Invalid credentials (49)


Any other ideas?
Thanks!

Daniel

-- 
LEVAI Daniel
PGP key ID = 0x4AC0A4B1
Key fingerprint = D037 03B9 C12D D338 4412  2D83 1373 917A 4AC0 A4B1

Follow-Ups:
- Re: TLS problems with openldap
  - From: Philip Guenther <guenther+ldapsoft@sendmail.com>
- Re: TLS problems with openldap
  - From: "Dieter Kluenter" <dieter@dkluenter.de>

References:
- TLS problems with openldap
  - From: LÉVAI Dániel <leva@ecentrum.hu>
- Re: TLS problems with openldap
  - From: Philip Guenther <guenther+ldapsoft@sendmail.com>

Prev by Date: Re: Problems converting slapd.conf to a directory: i am desperated
Next by Date: Support for "codice fiscale" syntax
Index(es):
- Chronological
- Thread